

North Carolina Security Breach Reporting Form 
Pursuant to the Identity Theft Protection Act of |005 


MAR I 2 2013 


*; r f ' f 


Name of Business or Government Agency Owning or Licensing 

Information Affected by the Breach: 

Haynes and Boone, LLP 

Address* 2323 Victory Avenue, Suite 7 00 


PLEASE SUBMIT FORM TO: 

Consumer Protection Division 
NC Attorney General’s Office 
9001 Mail Service Center 


Telephone: 

Fax: 

Email: 


Dallas, TX 75219-7673 

(214) 651-5760 
_________ 

chris.belknap@haynesboone.com 


Raleigh, NC 27699-9001 
Telephone: (919) 716-6000 
Toll Free in NC: (877) 566-7226 
FAX: (919) 716-6050 


Date Security Breach Reporting Form submitted: March 2? , 2013 _ 

Date the Security Breach was discovered: January 16, 2 013 _ 

58 6 

Estimated number of affected individuals: _ 

Estimated number of NC residents affected: 5 _ 

Name of business or government agency maintaining or possessing information that was the subject of the 
Security Breach, if the agency that experienced the Security Breach is not the same entity as the agency 
reporting the Security Breach (pursuant to N.C.G.S. § 75-65(b): 


Describe the circumstances surrounding the Security Breach and state whether the information breached was 

in electronic or paper format: _ 

_ Please See Attached Exhibits A and B _ 

Regarding electronic information breached, state whether the information breached or potentially breached 

was password protected or encrypted in some manner. _ If so, please describe the security 

measures protecting the information: N/A _ 


Describe any measures taken to prevent a similar Security Breach from occurring in the future:. 

Please See Attached Exhibit A and B 


Date affected NC residents were/will be notified: February 28, 2013 _ 

If there has been any delay in notifying affected NC residents, describe the circumstances surrounding the 
delay pursuant to N.C.G.S. § 75-65(a) and (c)): _ 


If the delay was pursuant to a request from law enforcement pursuant to N.C.G.S. § 75-65(c), please include the 
written request or the contemporaneous memorandum. 


How NC residents were/will be notified? rewritten notice 

(pursuant to N.C.G.S. § 75-65(e)) [^electronic notice (email) 

Please attach copy of the notice if in written form or a copy of [^telephone notice 


\ 

\\T Date:,?/7 jl\ 

Christopher Dilenno, 

l/Esquire and Jennifer/Coughlin, Esquire 

518 Township Line Roq 

|p. Suite 300, Blue Bell PA 19422 

.. _.~3 

r 


Signature: 

Contact Person, Title: 

Address: 

(if different from above) 

Telephone: (215)358-2100 Fax: (215)35^-5101 Emai 1: cdiienno@nldhlaw.com 


jcoughlin@nldhlaw.com 








haynes boone 


Haynes and Boone, LLP 
North Carolina Security Breach Reporting Form 

Exhibit “A” 

By providing this notice, Haynes and Boone, LLP (“Haynes Boone”) does not waive any rights 
or defenses regarding the applicability of North Carolina law or personal jurisdiction. 

I. Breach Summary 

Haynes Boone, 2323 Victory Avenue, Suite 700, Dallas, TX 75219, is informing your office of 
pertinent facts that are known at this time related to an exposure of vendor personal information 
due to a mailing issue involving IRS 1099 Forms. The mailing issue occurred when two 
different 1099 Forms were placed in one envelope prior to mailing. This resulted in the exposure 
of personal information of certain vendors, including their names, addresses. Social Security 
numbers reflected as tax identification numbers, tax identification numbers, and the amount paid 
by Haynes Boone to the vendor, by unintended recipients. 

Haynes Boone immediately took steps in responding to this inadvertent exposure of personal 
information. In addition to performing an internal investigation into the incident, Haynes Boone 
retained privacy and data security legal counsel Nelson, Levine, de Luca & Hamilton, LLC to 
assist in with its investigation of, and response to, this incident. The investigation is ongoing. 
This notice will be supplemented with any new significant facts learned subsequent to its 
submission. 

II. Information Security Measures 

Haynes Boone is a law firm based in Texas. On or about January 10, 2013, Haynes Boone 
prepared vendor IRS 1099 Forms for mailing. Two 1099 Forms were printed per paper, each 
taking up one-half of the page. The paper was perforated and separated before mailing; 
however, due to a processing issue some vendors received their own 1099 and a 1099 of another 
vendor. Each 1099 contained information including vendor names, addresses, Social Security 
numbers, tax identification numbers, and the amount paid by Haynes Boone to the vendor. 

III. Breach Response and Notification 

As discussed, Haynes Boone commenced an internal investigation to identify the vendors 
potentially affected by this data event and the personal information exposed. At this time, 
Haynes Boone is unaware of any actual or attempted misuse of the personal information. 
Haynes Boone established subsequent remedial measures, such as requiring all mailing from the 
accounting department to be signed off by an accounting supervisor or manager, to ensure that 
this type of situation does not happen again. Haynes Boone retained privacy and data security 


Haynes and Boone, LLf 
Attorneys and Counselor* 

2505 N Plano Road, Suite 400C 
Richardson, Texas 75082-4101 
Phone: 972.739.690C 
Fax: 972.680.7551 
www.haynesboone.conr 



hoynesboone 


counsel specializing in data breach response. Haynes Boone is providing notice of this data 
event to other state regulators. 

Although the investigation is ongoing, it appears that five (5) North Carolina residents’ personal 
information may have been exposed without authorization. These North Carolina residents were 
sent notification on or about February 28, 2013 in substantially the same form as the sample 
notice attached to this letter as Exhibit B. Haynes Boone is providing each affected vendor 
whose Social Security number may have been exposed with access to one year of Experian’s 
credit monitoring services, at no cost to the affected vendor. 


Haynes and Boone, LLP 
Attorneys and Counselor: 

2505 N Plano Road, Suite 400C 
Richardson, Texas 750824101 
Phone: 972.739.690C 
Fax: 972.680.7551 
www.haynesboone.ODrT 



haynes boone 


Exhibit B 


February 28,2013 

[ Name ] 

[ Address ] 

[ City, State Zip ] 

Dear_: 

We are writing to notify you of an incident that may affect the security of your personal 
information. On January 16, 2013, Haynes and Boone, LLP (“Haynes Boone”) discovered that 
your IRS Form 1099 may have been inadvertently mailed to another Haynes Boone vendor. 
During mail preparation two 1099s were inadvertently placed in one enveloped resulting in some 
vendors receiving their own 1099 with a 1099 of another vendor. Because 1099s include names, 
addresses. Social Security numbers, and the amount paid to you by Haynes Boone, we are 
informing you that your information may have been exposed to another vendor. 

If you did not receive a 1099 the week of January 14, 2013, your personal information may have 
been exposed to another Haynes Boone vendor. If you received your own 1099 and a 1099 of 
another vendor the week of January 14, 2013, your company’s personal information was not 
exposed to another vendor. Please destroy any 1099 that does not belong to you. 

Haynes Boone takes this matter, and the safety and security of personal information, seriously. 
In order to ensure that this type of situation does not happen again, we are requiring all mailings 
from the accounting department to be signed off by an accounting supervisor or manager. In 
addition to taking these steps internally, Haynes Boone retained privacy and data security legal 
counsel to assist in identifying legal obligations arising from this event and to provide 
information that you can use to best protect your interests. 

Although we are not aware of any actual or attempted improper use of your personal 
information, we retained Experian to provide—at no cost to you—one year of its ProtectMylD™ 
Alert identity monitoring and identity recovery services. This product helps detect possible 
misuse of your personal information and provides you with superior identity protection services 
focused on immediate identification and resolution of identity theft. 

Activity ProtectMylD™ Now in Three Easy Steps 

1. ENSURE that you enroll by: May 31,2013. 


Haynes and Boone, ILF 
Attorneys and Counselor; 

2505 N Plano Road, Suite 400C 
Richardson, Texas 75082-4101 
Phone: 972.739.690C 
Fax: 972.680.7551 
www.haynesboone.corr 



baynesboone 


2. VISIT the ProtectMylD™ Web Site: www.protectmvid.com/redeem or call 877-371- 
7902 to enroll. 


3. PROVIDE your activation code: [ code ]. 

Once your ProtectMylD™ membership is activated, your credit report will be monitored daily 
for 50 leading indicators of identity theft. You will receive timely Credit Alerts from 
ProtectMylD™ on any key changes in your credit report which could include new inquiries, new 
credit accounts, medical collections and changes to public records. 

ProtectMylD™ provides you with powerful identity protection that will help detect, protect and 
resolve potential identity theft. In the case that identity theft is detected, ProtectMylD™ will 
assign a dedicated U.S.-based Identity Theft Resolution Agent who will walk you through the 
process of fraud resolution from start to finish for seamless service. 

We realize that identity theft can happen months and even years after a data breach. To offer 
added protection, you will receive ExtendCARE™, which provides you with the same high-level 
of Fraud Resolution support even after your ProtectMylD™ membership has expired. 

Your complimentary 12-month ProtectMylD™ membership includes: 

• Credit Report: A free copy of your Experian credit report. 

• Daily Credit Monitoring: Alerts you of suspicious activity including new inquiries, 
newly opened accounts, delinquencies, or medical collections found on your Experian 
credit report. 

• Identity Theft Resolution: If you have been a victim of identity theft, you will be 
assigned a dedicated, U.S.-based Experian Identity Theft Resolution Agent who will walk 
you through the fraud resolution process, from start to finish. 

• ExtendCARE: Full access to the same personalized assistance from a highly-trained 
Fraud Resolution Agent even after your initial ProtectMylD™ membership expires. 

• $1 Million Identity Theft Insurance 1 : As a ProtectMylD™ member, you are 
immediately covered by a $1 Million insurance policy that can help you cover certain 
costs including lost wages, private investigator fees, and unauthorized electronic fund 
transfers. 

Once your enrollment in ProtectMylD™ is complete, you should carefully review your credit 
report for inaccurate or suspicious items. If you have any questions about ProtectMylD™, need 


1 Identity theft insurance is underwritten by insurance company subsidiaries or affiliates ofChartis, Inc. The 
description herein is a summary and intended for informational purposes only and does not include all terms, 
conditions and exclusions of the policies described. Please refer to the actual policies for terms, conditions, and 
exclusions of coverage. Coverage may not be available in all jurisdictions. 


Haynes and Boone, LLF 
Attorneys and Counselors 

2505 N Plano Road, Suite 400C 
Richardson, Texas 75082-4101 
Phone: 972.739.690C 
Fax: 972.680.7551 
www.haynesboone.com 
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help understanding something on your credit report or suspect that an item on your credit report 
may be fraudulent, please contact Experian’s customer care team at 877-371-7902. 


To further protect against possible identity theft or other financial loss and in addition to 
activating your ProtectMylD™, we encourage you to remain vigilant, to review your account 
statements, and to monitor your credit reports for suspicious activity. Under U.S. law, you are 
entitled to one free credit report annually from each of the three major credit bureaus. To order 
your free credit report, visit www.annualcreditreDQrt.com or call, toll-free, 1-877-322-8228. You 
may also contact the three major credit bureaus directly to request a free copy of your credit 
report. 


At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts 
creditors to take additional steps to verify your identity prior to granting credit in your name. 
Note, however, that because it tells creditors to follow certain procedures to protect you, it may 
also delay your ability to obtain credit while the agency verifies your identity. As soon as one 
credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. 
Should you wish to place a fraud alert, or should you have any questions regarding your credit 
report, please contact any one of the agencies listed below. 


Equifax 

P.O. Box 740241 
Atlanta, GA 30348 
800-685-1111 
www.equifax.com 


Experian 
P.O. Box 2104 
Allen, TX 75013 
888-397-3742 
www.experian.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19022 
800-888-4213 
www.transunion.com 


You can further educate yourself regarding identity theft, and the steps you can take to protect 
yourself, by contacting your state Attorney General or the Federal Trade Commission. For 
North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, 
Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For Maryland residents, the 
Attorney General can be contacted at 200 St. Paul Place, 16 th Floor, Baltimore, MD 21202, (888) 
743-0023, www.oag.state.md.us. 

The Federal Trade Commission can be reached at: 

Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 
www.ftc.gov/bcp/edu/microsites/idtheft/ 

1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261 


Haynes and Boone, LLF 
Attorneys and Counselors 

2505 N Plano Road, Suite 400C 
Richardson, Texas 750824101 
Phone: 972.739.6900 
Fax: 972.680.7551 
www.haynesboone.aom 
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The Federal Trade Commission encourages those who discover that their information has been 
misused to file a complaint with them. You can obtain further information on how to file such a 
complaint by way of the contact information listed above. Instances of known or suspected 
identity theft should also be reported to law enforcement. 


We apologize for any inconvenience or concern that this may have caused you, and encourage 
you to contact me directly at 214-651-5760 with any questions or concerns. 


Very truly yours/1 

^\F 

Chris Belknap, CPA 
Controller A 


Haynes and Boone, LLP 
Attorneys and Counselors 

2505 N Plano Road, Suite 4000 
Richardson, Texas 75082*4101 
Phone: 972.739.6900 
Fax: 972.680.7551 
www.haynesboone.com 
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February 28,2013 

[ Name] 

[ Address ] 

[ City, State Zip ] 

Dear_: 

We are writing to notify you of an incident that may affect the security of your company’s 
personal information. On January 16, 2013, Haynes and Boone, LLP (“Haynes Boone”) 
discovered that your IRS Form 1099 may have been inadvertently mailed to another Haynes 
Boone vendor. During mail preparation, two 1099s were inadvertently placed in one envelope, 
resulting in some vendors receiving their own 1099 with a 1099 of another vendor. These 1099 
forms include vendor names, addresses, tax identification numbers, and the amount paid to you 
by Haynes Boone. 

If you did not receive a 1099 the week of January 14, 2013, your company’s personal 
information may have been exposed to another Haynes Boone vendor. If you received your own 
1099 and a 1099 of another vendor the week of January 14, 2013, your company’s personal 
information was not exposed to another vendor. Please destroy any 1099 that does not belong to 
your company. 

Haynes Boone takes this matter, and the safety and security of its vendors’ personal information, 
seriously. To ensure that this does not happen again, we are requiring all mailings from the 
accounting department to be signed off by an accounting supervisor or manager. In addition to 
taking these steps internally, Haynes Boone retained privacy and data security legal counsel to 
assist in identifying legal obligations arising from this event and to provide information that you 
can use to best protect your interests. 

We are not aware of any improper use of your company’s personal information. However, to 
protect against possible identity theft or other financial loss, we encourage you to remain 
vigilant, to review your account statements, and to monitor your credit reports for suspicious 
activity. Under U.S. law, you are entitled to one free credit report annually from each of the 
three major credit bureaus. To order your free credit report, visit www.armualcreditreport.com 
or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly 
to request a free copy of your credit report. 

At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts 
creditors to take additional steps to verify your identity prior to granting credit in your name. 
Note, however, that because it tells creditors to follow certain procedures to protect you, it may 
also delay your ability to obtain credit while the agency verifies your identity. As soon as one 
credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. 


Haynes and Boone, LIP 
Attorneys and Counselors 
2505 N Plano Road, Suite 4000 
Richardson, Texas 75082-4101 
Phone: 972,739.6900 
Fax: 972.680.7551 
www.haynesboone.com 
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Should you wish to place a fraud alert, or should you have any questions regarding your credit 
report, please contact any one of the agencies listed below. 


Equifax 

P.O. Box 740241 
Atlanta, GA 30348 
800-685-1111 
www.equifax.com 


Experian 
P.O. Box 2104 
Allen, TX 75013 
888-397-3742 
www.experian.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19022 
800-888-4213 
www.transunion.com 


You can further educate yourself regarding identity theft, and the steps you can take to protect 
yourself, by contacting your state Attorney General or the Federal Trade Commission. For 
North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, 
Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For Maryland residents, the 
Attorney General can be contacted at 200 St. Paul Place, 16 th Floor, Baltimore, MD 21202, (888) 
743-0023, www.oag.state.md.us. 


The Federal Trade Commission can be reached at: 


Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 
www.ftc.gov/bcp/edu/microsites/idtheft/ 

1-877-ID-THEFT (1-877-438-4338); TTY; 1-866-653-4261 

The Federal Trade Commission encourages those who discover that their information has been 
misused to file a complaint with them. You can obtain further information on how to file such a 
complaint by way of the contact information listed above. Instances of known or suspected 
identity theft should also be reported to law enforcement. 

We apologize for any inconvenience or concern that this may have caused you, and encourage 
you to contact me directly at 214-651-5760 with any questions or concerns. 

Very truly ypurs^ 


Chris Belknap, CPA 
Controller 


Haynes and Boone, LU 3 
Attorneys and Counselors 

2505 N Plano Road, Suite 4000 
Richardson, Texas 750824101 
Phone: 972.739.6900 
Fax: 972.680.7551 
vvww. haynesboone.com 



